In control systems, and particularly in control systems in the aviation art, redundant channel signal processing is frequently used to increase the reliability and safety of the system. In aircraft engine applications digital control systems may be used, for example, to regulate steady-state and transient power output over the available power range, to maximize engine cycle efficiency, to provide the required thrust response during power changes, and to provide stable operation under all operating conditions.
Digital control systems are trending towards the use of more sensors to improve the system's availability and performance through redundancy. To validate signals, validity tests must be performed on each sensor signal and their results must be processed by selection logic. Current systems achieve noise immunity and tolerance to intermittent failures by, for example, scattering persistence counters and latches throughout the validity tests and selection logic. Current systems may also tailor the validity logic design to the needs of each sensor. The result has been a very rapid increase in the size and complexity of the logic used to validate signals. There is a need for a signal validation strategy which can handle noise and different kinds of failures with reduced overall complexity. Furthermore, there is a need for a signal validation method flexible enough to handle various kinds of sensors.
U.S. Pat. No. 4,916,612 to Chin et al discloses an approach for providing a signal selection and fault detection system that is fail operative. In this system, the outputs from a pair of sensors are received by a midvalue selector. The midvalue selector also receives a third input that is representative of the sensed condition. In a normal mode of operation i.e., when neither of the first and second redundant input signals has failed, or is about to fail, the third input signal is produced by a normal mode complementary filter. This filter integrates a condition rate signal that is representative of the rate of change of the condition. When a failure condition occurs the output of a failure mode complementary filter is substituted for the output of the normal mode complementary filter as the third input to the midvalue selector.
While the control system described in the aforementioned patent may have been suitable for aircraft systems, it may not be suitable for other applications, e.g. aircraft engines for various reasons. Firstly, the coupling of the selection logic to the fault logic may require a redesign of the logic structure if the control system is to be used in other areas of technology. Secondly, in expanding the control system for selecting valid signals from among several sensors, i.e. three or more, the size and complexity of the logic required for the system may rapidly increase. Thirdly, the control system does not include a means for restoring a signal once it has been declared failed. Electrical failures are often temporary and the failed component may resume proper operation after failing for a short period. A fault detection method which cannot restore a signal after a fault may not regain the advantages of full redundancy when it is available.